Linux kernel vulnerabilities

In the Linux kernel, an unnecessary rcu_barrier() call was removed from br_multicast_dev_del() in the network bridge module. This call originated from a time when call_rcu() was used in br_multicast.c, but since kfree_rcu() is now used, the barrier is no longer needed and causes excessive RTNL pressure. This led to task stalls waiting on mutexes, as reported by syzbot.

In the Linux kernel, the ntfs3 filesystem did not handle set_blocksize failures; because it uses buffer_heads which do not handle block sizes larger than PAGE_SIZE well, mounting could hit BUG_ON in folio_set_bh. The fix handles these failures.

In the Linux kernel, the isofs filesystem did not handle set_blocksize failures; because it uses buffer_heads which do not handle block sizes larger than PAGE_SIZE well, mounting could hit BUG_ON in folio_set_bh. The fix handles these failures.

In the Linux kernel, the irqchip/gic-v5 driver performed the priority drop only in irq_eoi(), together with interrupt deactivation. Since all interrupts share the same priority, long-running processing could block signaling of new interrupts. The fix moves the priority drop to occur immediately after acknowledging an interrupt in the main GICv5 handler.

In the Linux kernel, the irqchip/gic-v4 driver advertised VLPI support even when no ITS controller was probed. With kvm-arm.vgic_v4_enable=1 on a system lacking an MSI device tree node and GICv4, a NULL pointer dereference (gic_domain) caused a panic. The fix sets vLPI support to false at init time if the host has no ITS.

In the Linux kernel, host1x_device_init() error teardown paths did not check client->ops before dereferencing it, unlike the init paths. This could result in a NULL pointer dereference if client->ops was NULL. The fix adds the missing check in the teardown and teardown_late labels.

In the Linux kernel, the drm/nouveau/gsp driver lacked a SEC2 entry in the GA100 chip table. During tu102_gsp_oneinit(), the booter constructor needs device->sec2 to access the SEC2 falcon; without the entry, device->sec2 is NULL and this dereference crashes during GSP-RM boot.

In the Linux kernel, the iwlwifi (mld) driver triggered WARN_ON() when suspending with WoWLAN configured but not connected to a network and without netdetect. The fix removes the warning and lets the driver cleanly handle this case by returning 1 to disconnect and suspend.

In the Linux kernel, the netfilter nf_conntrack_expect module did not zero expectation structures at allocation time, potentially leaking uninitialized data to userspace via ctnetlink. The fix zeroes memory at allocation time.

In the Linux kernel, the freevxfs filesystem called BUG() when encountering an unknown typed-extent type in vxfs_bmap_typed(), causing a kernel crash. The fix replaces BUG() with WARN_ON_ONCE() and returns 0, so ioctl(FIBMAP) fails cleanly.

In the Linux kernel, the ksmbd server removed a connection's channels from other sessions' lists only while conn->binding was set, leaving stale channels pointing to a freed ksmbd_conn after the flag was cleared. This led to a use-after-free on teardown and session leak. The fix removes the conn->binding gate.

A flaw was fixed in the Linux kernel BPF verifier's 32-bit zero extension logic. The removal of register liveness tracking in commit 107e16979905 allowed certain verification paths to miss the zext_dst mark, potentially letting a BPF program inject an arbitrary value into the upper half of a register. The fix replaces subreg_def-based logic with static liveness analysis in bpf_compute_live_registers().

A vulnerability in the Linux kernel Bluetooth ISO module has been resolved. The content of a Periodic Advertisement Report is copied to BASE only if the service UUID matches the Basic Audio Announcement Service UUID.

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment. cache_replay(), the writeback worker and the GC worker read a kset of get_kset_onmedia_size() bytes and advance the position by it. A forged key_num makes that size exceed the segment's remaining space, so the advance walks past the segment and trips the cache_pos_advance() BUG_ON.

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory. cache_key_decode() takes a key's logical off from the cache device and later indexes req_key_tree->subtrees[] by it in get_subtree(). An off past the device forms a subtree pointer outside the array, which rb_insert() writes through during replay.

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF. Add a sched_cache_grp pointer to task_struct so that scheduler code can access the cache group directly via the task, without going through mm->sched_cache_grp. This decouples the scheduler's hot-path accesses from the mm_struct. Each task holds its own refcount on the sched_cache_group, separate from the reference held by its mm_struct. The reference is acquired in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm(). This fixes the use-after-free when account_mm_sched() reaches the group through a task whose mm is being switched.

In the Linux kernel's sched_ext scheduler, ops.dequeue() was invoked while the source user DSQ lock was still held on the consume and move paths. A BPF scheduler that locks the source DSQ from ops.dequeue() would self-deadlock. The fix moves the invocation after the DSQ unlock on all three paths.

In the Linux kernel's sched_ext, a task could be found on a DSQ while still in SCX_OPSS_DISPATCHING state. The reenqueue paths did not wait for the state to clear, so ops.enqueue() set SCX_OPSS_QUEUED and the dispatcher's final store overwrote it with SCX_OPSS_NONE, dropping later dispatches of the task. The fix waits for SCX_OPSS_DISPATCHING to clear before dequeueing for reenqueue.

In KVM on x86, GET_NESTED_STATE_PAGES was not re-pended when fetching nested pages failed in the KVM_RUN path. If userspace re-ran the vCPU and vmcs02 held valid PFNs from the previous L2 run, KVM could re-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.

In the Linux kernel audit subsystem, kill_rules() removed mixed AUDIT_DIR and AUDIT_EXE rules when pruning an audit tree, dropping entry->rule.exe before removing the rule from RCU-visible filter lists. Removing the watched directory could race with another task evaluating the rule, causing a use-after-free in audit_mark_compare().

A vulnerability was fixed in the Linux kernel's fprobe mechanism where unregister_fprobe() and unregister_fprobe_async() relied on standard RCU grace periods that do not track preemption-disabled sections when RCU is not watching (e.g., in the idle loop or nohz_full extended quiescent states). This could lead to a use-after-free if the fprobe was freed immediately after unregistration. The fix ensures handlers exit early when !rcu_is_watching() and replaces guard(rcu)() and rcu_read_lock() with guard(rcu_sched_notrace)(), eliminating fast-path lockdep overhead.

In the Linux kernel HID BPF subsystem, the comparison of the return value from hid_bpf_hw_request against size did not cast size to ssize_t. When a transport driver returned a negative error code (e.g. -EPIPE), it was promoted to size_t and evaluated as a large positive number, making (ret > size) true. This silently converted the hardware error into a success and copied the unmodified buffer back.

In the Linux kernel, the HID multitouch driver's mt_remove() used timer_delete_sync() to stop the sticky-finger release timer. However, the timer could be rearmed by a report arriving after deletion, leading to a use-after-free when the timer fired after the driver was unbound. The fix replaces timer_delete_sync() with timer_shutdown_sync(), which also prevents any subsequent mod_timer() from rearming the timer.

In the Linux kernel io_uring with SQPOLL, the sqpoll thread could pop and complete a request as soon as mpscq_push() published it. If that was the last request holding the ring alive, io_ring_exit_work() freed the ctx, stopped the thread and tctx while io_req_normal_work_add() was still referencing them, causing a use-after-free. The fix holds an RCU read lock across the add and waits for a grace period before freeing the ctx.

In the Linux kernel IPVS, ip_vs_lblcr_new() and ip_vs_lblc_new() created cache entries for every previously unseen destination address, while the table max_size only told the periodic collector to reclaim entries after the limit was exceeded. An attacker could keep using entries, causing unbounded memory growth. The fix rejects new entries once a table reaches max_size * 3 / 2.

In the Linux kernel kprobes on x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, get_optimized_kprobe() stops at B when arming a new probe C at A+4, leaving A optimized. The INT3 for C overwrites the last byte of A's jump displacement, so execution can jump to the wrong address. The fix skips disarmed and unprepared probes when checking optkprobe overlap.

In the Linux kernel, add_changeset_property() (of/overlay) links a new property of a not-yet-live target node into the node's deadprops list before calling of_changeset_add_property(). If that call fails, the error path frees the property but leaves the freed pointer linked in deadprops, causing a double free when the aborted overlay's node is released.

In the Linux kernel, of_overlay_fdt_apply() stores the idr_alloc() return value in ovcs->id before checking it. On allocation failure the stored id is negative, so free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove() is called with a negative id, and list_del() runs on the not-yet-initialized ovcs->ovcs_list, dereferencing NULL.

In the Linux kernel, IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stack. The fix counts IPv4 and IPv6 GSO handler entries in skb_gso_cb and limits them using IP_TUNNEL_RECURSION_LIMIT.

A bug in the Linux kernel's detection of IPv6 extension headers in tunneled packets has been fixed. The skb_gso_has_extension_hdr() function incorrectly handled GSO packets with skb->encapsulation set, leading to false positives and packet drops in IPv6 tunnels (ip6_gre, ip6_tunnel) and incorrect network header length calculation. The fix checks ipv6_ext_hdr() on both outer and inner IPv6 headers using skb_header_pointer() for safe reads.

In the Linux kernel, nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_netns_get(). When the latter fails, the error is returned as-is and the reference is leaked, and upper layers do not balance it either because nf_tables_newexpr() clears expr->ops when the expression init callback fails. Each failed rule addition therefore leaks one flowtable reference.

In the Linux kernel, tpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds each valid packet length to the signed int len_sum. Because userspace can recycle completed frames concurrently, a single blocking send call is not bounded by the ring size, and after enough successful transmissions len_sum wraps into the negative range. sock_sendmsg_nosec() treats the result as an impossible return and triggers a BUG.

In the Linux kernel, pfcp_newlink() creates the UDP socket before registering the netdevice. If registration fails, the socket is released twice, leading to a NULL pointer dereference.

In the Linux kernel, the ac100 RTC driver assigns .num only after storing all clocks in .hws[], which with CONFIG_UBSAN_BOUNDS triggers an array-index-out-of-bounds report during probe.

In the Linux kernel, the spear RTC driver's devm_request_irq() enables the interrupt before device initialization completes, potentially running the handler on not fully initialized hardware.

In the Linux kernel, SCTP's sctp_wait_for_connect() drops the socket lock while sleeping, allowing an ABORT to be processed and the association unlinked. If a concurrent shutdown(fd, SHUT_RD) sets RCV_SHUTDOWN, the function returns without checking asoc->base.dead, leading to a dangling pointer.

A vulnerability was found in the Linux kernel where a null key name mismatch in the TPM subsystem did not disable the TPM chip. The tpm2_load_null() function returned success (rc = 0) despite an integrity check failure, so the chip continued serving commands and an uninitialized stack value could be used as the key handle. The fix sets rc to -ENODEV on mismatch, which disables the chip and returns the correct error code to the caller.

In the Linux kernel, netfs's netfs_read_gaps() leaves gaps around a streaming write's dirty region unread, so a short/EOF response leaves stale folio content that later gets written back.

In the Linux kernel, codetag_load_module() does not set the error code on failure, so load_module() returns 0 after the module has been torn down. Additionally, for livepatch, mod->klp_info leaks on this error path.

The Linux kernel vmgenid driver registers its notification/IRQ handler before assigning driver_data, which the handler dereferences. If an interrupt or ACPI notification arrives in that window (e.g., when a VMM injects a generation-changed notification during snapshot restore in Firecracker), the handler dereferences a still-NULL pointer and panics the kernel. The fix assigns driver_data before registering the handlers.

In the Linux kernel, vc_screen's reload of the 'vc' pointer in vcs_write() is after the 'if (ret)' block, so the copy-failure break path exits without reloading vc. If vc was freed via vc_port_destruct during the unlocked copy_from_user() window, a use-after-free occurs.

In the Linux kernel, paste_selection() contains an unsigned underflow and slab-out-of-bounds read. When the line discipline buffer fills up, the function sleeps and drops the selection mutex, allowing a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl to replace the buffer with a shorter selection. Upon resuming, vc_sel.buf_len - pasted underflows, causing an out-of-bounds read of up to 4094 bytes past the newly allocated buffer.

A slab-out-of-bounds read vulnerability exists in the Linux kernel's fb_pad_aligned_buffer function. It occurs when the font size of an invisible virtual console is changed and then the ESC # 8 (DEC alignment test) sequence is issued, which bypasses the con_should_update() check before updating the screen.

In the Linux kernel, the ALSA caiaq driver registers an input device in setup_card(), but if snd_card_register() or snd_usb_caiaq_control_init() fails, snd_card_free() frees the device state without unregistering the input device. A subsequent read of the "uevent" attribute then dereferences freed memory (use-after-free).

In the Linux kernel, the IIO kionix-kx022a driver performs an incorrect array boundary check when converting a register value to an array index. The check incorrectly accepts sizeof(array) as the last index, when the last valid index should be sizeof(array) - 1.

In the Linux kernel, in the MTD subsystem, mtd_otp_nvmem_add() unregisters the user OTP NVMEM device on factory OTP setup failure but leaves mtd->otp_user_nvmem set. This leads to a double-free when the device is unregistered again.

In the Linux kernel, in the MTD subsystem, __get_mtd_device() calls the master's _get_device() callback with mtd, which may be a partition, while __put_mtd_device() passes the master. This breaks gluebi partitions that require the master MTD via container_of().

In the Linux kernel, in blk-cgroup, blkg_tryget_closest() uses spin_lock_irq() and spin_unlock_irq(), which unconditionally enables local interrupts. When callers already have interrupts disabled (e.g., dm-thin), this leads to a deadlock because an I/O completion softirq can re-acquire the lock on the same CPU.

In the Linux kernel, in of/overlay, init_overlay_changeset() stores the number of initialized fragments in ovcs->count only on full success. When find_target() or the __symbols__ lookup fails partway through, fragment references are never dropped, leading to a memory leak.

In the Linux kernel, in the wfx wifi driver, wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. An oversized length field overruns the caller buffer and reads past the end of the reply allocation.